This advisory covers multiple security fixes in the Linux kernel packages for Red Hat Enterprise Linux 8 and 10. Key vulnerabilities include CVE-2026-31419, a use-after-free in the bonding driver causing denial of service; CVE-2026-31467, a denial of service in the erofs filesystem; CVE-2026-31532, a use-after-free in the raw CAN driver; CVE-2026-31581, a use-after-free in ALSA 6fire on disconnect; CVE-2026-43037, an issue in ip6_tunnel; CVE-2026-43501, a reservation issue in ipv6 rpl; and CVE-2026-46054, an access check flaw in selinux overlayfs mmap and mprotect. Red Hat has issued updated kernel packages for multiple architectures and product variants, including BaseOS, AppStream, and CodeReady Linux Builder. The updates fix these vulnerabilities and require reboot to take effect. No known exploits in the wild have been reported.

The vulnerabilities addressed can lead to denial of service conditions or potential memory corruption due to use-after-free bugs in kernel drivers and subsystems. This could cause system instability or crashes. The advisory rates the impact as critical for Red Hat Enterprise Linux 10 and important for version 8. No active exploitation has been reported, but the flaws affect core kernel components, which are critical to system operation.

Red Hat has released official kernel updates that address these vulnerabilities. Users should apply the provided security updates for their respective Red Hat Enterprise Linux versions and architectures as detailed in the Red Hat advisories RHSA-2026:27353 and RHSA-2026:25191. A system reboot is required to activate the updated kernel. No additional mitigations are indicated beyond applying these official patches.